Encryption for users. Part one.
One of my customers somehow needed a way to organize secure communication between several people. For communication was supposed to use instant messaging system (ICQ). As far as I know - for telephone conversations they bought some attachments that encrypted the voice signal. I didn’t see them live, so I can’t say how effective they are. But I want to tell you about the encryption of electronic messages in detail. Fortunately, I took them up.
In encryption, I'm still an amateur. I do not have a set of tools for checking encrypted messages for cryptographic strength, it is very difficult for me to evaluate encryption algorithms due to the lack of such experience and generally I only deal with the base64 and md5 algorithms. That is why I can only offer what I heard from other people. In this case, I proposed two options, describing their main pros and cons.
The first contender for the provider of electronic information was Skype.
The main reason for its use is a commercial product with its technical support. In addition to text messages and files, he can transmit video and voice, which is undoubtedly attractive to the average user. At the same time, a beautiful interface also plays into their hands. Theoretically, it can also be used to hide your location by connecting the services of calls from Skype to city numbers and from city numbers to Skype. It looks quite attractive.
')
But Skype also has disadvantages. The main one is a closed commercial development. Few people know what's going on inside it. It does not contribute to security. Also, compared with the second candidate for the role of a provider of secure data, which will be slightly lower, Skype is younger. I, like my customer, consider it about the same - in such a case as security is better than old than young algorithm, provided that none of them have yet learned how to hack.
The second challenger is the good old cryptographer pgp and its free analog gnupg.
He has a lot of advantages too. Starting with the fact that these are open algorithms - and, accordingly, their reliability, given their age, is potentially higher than that of Skype. At the same time they are supported by a sufficiently large amount of software. In some, the ability to encrypt using pgp / gpg is built in initially, while in others they are integrated with plugins. From this follows the width of the scope of application - with its help you can not only transfer data, but also encrypt files and entire disks.
Of the minuses, you can answer the lack of free software that can beautifully manage with all of this economy. And the one that is far inferior in terms of usability to the first applicant. Despite the support of many applications, everyone does it differently, so you have to get used to each new tool.
As a result, gnupg was chosen.
The advantage in the reliability of the algorithms played a role. But, I think, if encryption should have been used in a company of 12 people, and not in a company of three people, Skype would have won due to the ease of implementation.
I will not talk for a long time about software that can be used in my work - I can say that I tried it myself. And I tried not so much as I would like.
The situation is worse with graphical key management utilities. Most of all I liked the plugin for thunderbird - enigmail . Despite the problems with the language - in a couple of places he constantly gets a coding error, he has a Russification, is pretty and quite intuitive. I compared it with two utilities that are part of gpg4win . In particular, the latter do not know how to import or export a public key to the clipboard, which is very often convenient when exchanging public keys, and the procedure for installing the Russian language is somewhat nontrivial for a simple user.
I believe that encryption should be massive. It saves from a lot of things - from hacking and ending with the usual listening. In my opinion, if encryption of messages will gain popularity, this will only benefit the public, if, of course, it is possible to overcome the resistance of states and relevant services.
Original
In encryption, I'm still an amateur. I do not have a set of tools for checking encrypted messages for cryptographic strength, it is very difficult for me to evaluate encryption algorithms due to the lack of such experience and generally I only deal with the base64 and md5 algorithms. That is why I can only offer what I heard from other people. In this case, I proposed two options, describing their main pros and cons.
The first contender for the provider of electronic information was Skype.
The main reason for its use is a commercial product with its technical support. In addition to text messages and files, he can transmit video and voice, which is undoubtedly attractive to the average user. At the same time, a beautiful interface also plays into their hands. Theoretically, it can also be used to hide your location by connecting the services of calls from Skype to city numbers and from city numbers to Skype. It looks quite attractive.
')
But Skype also has disadvantages. The main one is a closed commercial development. Few people know what's going on inside it. It does not contribute to security. Also, compared with the second candidate for the role of a provider of secure data, which will be slightly lower, Skype is younger. I, like my customer, consider it about the same - in such a case as security is better than old than young algorithm, provided that none of them have yet learned how to hack.
The second challenger is the good old cryptographer pgp and its free analog gnupg.
He has a lot of advantages too. Starting with the fact that these are open algorithms - and, accordingly, their reliability, given their age, is potentially higher than that of Skype. At the same time they are supported by a sufficiently large amount of software. In some, the ability to encrypt using pgp / gpg is built in initially, while in others they are integrated with plugins. From this follows the width of the scope of application - with its help you can not only transfer data, but also encrypt files and entire disks.
Of the minuses, you can answer the lack of free software that can beautifully manage with all of this economy. And the one that is far inferior in terms of usability to the first applicant. Despite the support of many applications, everyone does it differently, so you have to get used to each new tool.
As a result, gnupg was chosen.
The advantage in the reliability of the algorithms played a role. But, I think, if encryption should have been used in a company of 12 people, and not in a company of three people, Skype would have won due to the ease of implementation.
I will not talk for a long time about software that can be used in my work - I can say that I tried it myself. And I tried not so much as I would like.
The situation is worse with graphical key management utilities. Most of all I liked the plugin for thunderbird - enigmail . Despite the problems with the language - in a couple of places he constantly gets a coding error, he has a Russification, is pretty and quite intuitive. I compared it with two utilities that are part of gpg4win . In particular, the latter do not know how to import or export a public key to the clipboard, which is very often convenient when exchanging public keys, and the procedure for installing the Russian language is somewhat nontrivial for a simple user.
I believe that encryption should be massive. It saves from a lot of things - from hacking and ending with the usual listening. In my opinion, if encryption of messages will gain popularity, this will only benefit the public, if, of course, it is possible to overcome the resistance of states and relevant services.
Original
Source: https://habr.com/ru/post/28110/
All Articles